Home / Security / Advisories / NTAP-20260925-0009

NTAP-20260925-0009 — CVE-2024-53221 Linux Kernel Vulnerability in NetApp Products

Published 2026-09-25 · Updated 2026-09-25 · Status: Interim · Exploitation: Public · Severity: MEDIUM 5.5 · ONTAP affected: Yes

Official advisory: NTAP-20260925-0009 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: SolidFire / NetApp HCI · Baseboard management controllers · Active IQ Unified Manager · Brocade SAN firmware · ONTAP · Other NetApp products · NetApp Console / BlueXP · SnapCenter | ONTAP-relevant | highest CVSS: 5.5

CVEs in this advisory

CVE-2024-53221 — MEDIUM · CVSS 5.5 · site index

What the CVE records say

CVE-2024-53221 — In the Linux kernel, the following vulnerability has been resolved: f2fs: fix null-ptr-deref in f2fs_submit_page_bio() There's issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace: <TASK> f2fs_submit_page_bio+0x126/0x8b0 [f2fs] __get_meta_page+0x1d4/0x920 [f2fs] get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs] validate_checkpoint+0xac/0x290 [f2fs] f2fs_get_valid_checkpoint+0x207/0x950 [f2fs] f2fs_fill_super+0x1007/0x39b0 [f2fs] mount_bdev+0x183/0x250 legacy_get_tree+0xf4/0x1e0 vfs_get_tree+0x88/0x340 do_new_mount+0x283/0x5e0 path_mount+0x2b2/0x15b0 __x64_sys_mount+0x1fe/0x270 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Above issue happens as the biset of the f2fs file system is not initialized before register "f2fs_fs_type". To address above issue just register "f2fs_fs_type" at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized.

Impact

Successful exploitation of this vulnerability could lead to Denial of Service (DoS).

Affected products

NetApp HCI Baseboard Management Controller (BMC) - H610S
AFF Baseboard Management Controller (BMC) - A700s
Active IQ Unified Manager for VMware vSphere
Brocade Fabric Operating System Firmware
Cloud Volumes ONTAP Mediator
FAS/AFF BIOS - A900/9500
FAS/AFF Baseboard Management Controller (BMC) - A250/500f/C250
NetApp Console Agent OVA
ONTAP tools for VMware vSphere 10
SnapCenter Plug-in for VMware vSphere

References

https://nvd.nist.gov/vuln/detail/CVE-2024-53221 ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.